macOS Server 5.2 Port Forwarding

Question

macOS Server 5.2 Port Forwarding

I have setup macOS Server 5.2 on a Mac Mini, and in order to see a list of services available to Server, I must open DMZ on the firewall to allow all traffic to the IP address of the server. Else no services are detected by server as "availalble" over the internet.

This list below is is only populated if DMZ is open to the server:

Apple has often referred me to their published list of all common ports used by Apple, but of course will not recommend any specific settings. I have opened virtually every port in the list below for the services desired and Server still does not detect the services as available.

TCP and UDP ports used by Apple software products - Apple Support

Since DMZ is undesirable, my questions are:

1. What specific ports need to be forwarded on our router to the IP Address of the Server, as opposed to the ports just being "open" of services to be available?

2. Is there one specific port that needs to be forwarded that perhaps allows for the "available services" list to be polulated in Server ?

Thansk

Peter

iPhone 6, iOS 10.1.1

Posted on Dec 12, 2016 3:02 PM

Reply

Answer 1

Dec 13, 2016 2:51 AM in response to Peter Monahan

I would suggest some of the services you list you would not actually want to make accessible. In particular you should not make Server Administration available via the Internet and in most cases would not want or need DNS to be accessible to the Internet.

With regards to DNS it is more common to have separate DNS servers for internal use and external use. The external DNS server is often run by an Internet or domain name company for you. You may even have different domains in use both externally and internally. It is possible to use the same domain both internally and externally and this is referred to as a 'split horizon' domain configuration.

For your information the port for allowing DNS access - should you chose to allow this is port 53 over both TCP and UDP.

For Calendar server the ports are 80 and 443 over just TCP.

For Mail server the ports are 25, 465, 587, 143, 993, 110, 995 all over just TCP.

As mentioned I do not recommend allowing Internet connection to remotely administer Server.app however I believe the ports it would require are 311 and 625 both just over TCP.

Reply

Answer 2

Dec 13, 2016 5:15 AM in response to John Lockwood

I agree with services such as remote admin of server should not be permitted; that was basically my point, however the ONLY way that I could get any services to appear in the list at all was to open DMZ to the server, allowing ALL traffic, even though I have most all ports mentioned forwarded to the server. That is what I was trying to get away from.

The ports that you mention just need to be open, or open AND forwarded inbound to the server?

(And you are correct about ports 311 and 625 for remote server admin)

Thanks

Peter

Reply

Answer 3

Dec 13, 2016 5:58 AM in response to Peter Monahan

The ports need to be forwarded to the server.

Using Apple's Reachability test feature in Server.app may also need certain ports open. The communication is initiated from the client end i.e. the Server.app end and therefore replies will get back to it without needing port forwarding (for reachability).

I could not find for certain which ports Apple's Reachability test uses for communicating with the Apple server but you certainly need to allow out-bound access to the entire 17.0.0.0 subnet which is all owned by Apple. Some sites restrict outbound access as standard which maybe a contributor to this sort of problem.

Having Reachability blocked will not prevent the services form working merely that Server.app cannot report properly. You can turn Reachability testing off.

Reply

Answer 4

Dec 17, 2016 2:10 AM in response to John Lockwood

It was the "reachability" feature that was throwing me off. All Services are working, but Still haven't discovered the port that needs to be open for "reachability" to display the available services. All desired services are functioning, despite Server.app not showing the services as reachable.

Reply